6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896 | Triage

Analysis

max time kernel
127s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/02/2022, 02:18

Sharing

Report Analysis Logs

General

Target

6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896.exe
Size

2.9MB
MD5

cf2264987cc01dc8d3f72027347a968b
SHA1

3d385b316df5d37d39b10113a67080fc1516e0c9
SHA256

6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896
SHA512

3a8ce5a82f4455804e8f0a43526b8d60524426a4a4ae04f777cfd6d139ef6e7adcc4cbc07fcbe6399f6ad583e293fa6f6b27e95db30f14a89cf51ca5622516e6

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	740	svchost.exe
Token: SeCreatePagefilePrivilege	740	svchost.exe
Token: SeShutdownPrivilege	740	svchost.exe
Token: SeCreatePagefilePrivilege	740	svchost.exe
Token: SeShutdownPrivilege	740	svchost.exe
Token: SeCreatePagefilePrivilege	740	svchost.exe

C:\Users\Admin\AppData\Local\Temp\6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896.exe
"C:\Users\Admin\AppData\Local\Temp\6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896.exe"
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-130-0x00000227D7320000-0x00000227D7330000-memory.dmp

Filesize
64KB

Download
memory/740-131-0x00000227D7380000-0x00000227D7390000-memory.dmp

Filesize
64KB

Download
memory/740-132-0x00000227D9A30000-0x00000227D9A34000-memory.dmp

Filesize
16KB

Download